fix(hermes): validate tagged WebUI releases

ci/scripts/hermes_webui_flux_release.py

@@ -63,10 +63,15 @@ def render_workload(
     suffixes: dict[int, str] = {}
     for index, line in enumerate(lines):
         stripped = line.strip()
-        if not stripped.startswith(f"image: {image}@"):
+        if not stripped.startswith("image: "):
+            continue
+        value, separator, comment = stripped.removeprefix("image: ").partition(" #")
+        current_image, at, current_digest = value.rpartition("@")
+        if not at or not re.fullmatch(
+            rf"{re.escape(image)}(?::[A-Za-z0-9_][A-Za-z0-9_.-]{{0,127}})?",
+            current_image,
+        ):
             continue
-        value = stripped.removeprefix(f"image: {image}@")
-        current_digest, separator, comment = value.partition(" #")
         validated(current_digest, DIGEST_PATTERN, "current Flux image digest")
         matches.append(index)
         suffixes[index] = f" #{comment}" if separator else ""

testing/tests/test_hermes_webui_release.py

@@ -169,6 +169,30 @@ def test_renderer_updates_exact_chat_and_dashboard_webui_only(tmp_path: Path) ->
     module.validate_release_artifacts(**kwargs)
 
 
+def test_renderer_accepts_flux_tagged_digest_reference() -> None:
+    """Flux's whole-image setter may retain the selected release tag."""
+    module = _load(RELEASE, "hermes_webui_release_tagged_digest")
+    old_digest = "sha256:" + "1" * 64
+    new_digest = "sha256:" + "2" * 64
+    source = (
+        "apiVersion: apps/v1\n"
+        "kind: Deployment\n"
+        "metadata:\n"
+        "  name: hermes\n"
+        "spec:\n"
+        "  image: registry.bstein.dev/bstein/hermes-webui:"
+        f"git-{'a' * 40}-build-7-release@{old_digest} "
+        '# {"$imagepolicy": "hermes:hermes-webui-release"}\n'
+    )
+
+    rendered = module.render_workload(
+        source, new_digest, kind="Deployment", name="hermes"
+    )
+
+    assert f"image: {module.DEFAULT_IMAGE}@{new_digest}" in rendered
+    assert '"$imagepolicy": "hermes:hermes-webui-release"' in rendered
+
+
 @pytest.mark.parametrize(
     ("source", "kind", "name", "match"),
     [